# B2B website security baseline

- Source: https://simeoncreatives.com/resources/b2b-website-security-baseline
- Hub: Website Design & Development

A marketing-site threat model you can fill: assets, identities, secrets, forms, dependencies, backups, and a named restore test.

One owner per row. If everyone owns secrets, nobody does. Walk it before launch and after any plugin or form change.
This is a baseline for a brochure or lead-gen site, not a bank. Escalations (pentest, bug bounty) sit outside this card.

```mermaid
flowchart TD
    A["Assets"] --> I["Identities"]
    I --> S["Secrets"]
    S --> F["Forms"]
    F --> D["Dependencies"]
    D --> B["Backup plus restore"]
```
*List what you have, who can touch it, then prove you can restore it.*

## Assets

- [ ] Registrar, DNS host, and certificate owner named
- [ ] CMS or git repo URL listed; staging is not production
- [ ] Every public form URL listed with where the payload goes
- [ ] Object storage / CDN bucket named

## Identities and roles

- [ ] Admin seats counted. Fewer than you think you need.
- [ ] Leavers removed from CMS, git, DNS, analytics, ads
- [ ] No shared “marketing@” password in a slide deck
- [ ] Multi-factor authentication (MFA) on registrar, DNS, CMS, git, email

## Secrets

- [ ] No API keys in the public repo or client JavaScript
- [ ] Production secrets live in the host secret store, not a Notion page
- [ ] Rotation owner named for form keys, CMS keys, analytics

## Forms

- [ ] Forms post only over HTTPS to an origin you control
- [ ] Bot filter that is not “please wait 0ms”
- [ ] File uploads off unless you have a scanned store. Default is no.
- [ ] Failure still stores or retries. A 500 is not a silent lead death.

## Backup and restore

- [ ] What is backed up: git, CMS export, DNS zone, form archive
- [ ] Last restore test date (a real restore, not a screenshot of a backup job)
- [ ] Who is awake if the site 500s on a Monday

## Related guides

- [B2B website security for marketing teams](https://simeoncreatives.com/blog/b2b-website-security-marketing-teams)
- [Dynamic web forms and edge functions](https://simeoncreatives.com/blog/dynamic-web-forms-supabase-edge-functions)
- [Modern web maintenance blueprint](https://simeoncreatives.com/blog/modern-web-maintenance-blueprint)